BaseFortify

Publication date: 2026-01-28

Last updated on: 2026-02-03

Assigner: Go Project

Description

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-28

Last Modified

2026-02-03

Generated

2026-07-06

AI Q&A

2026-01-29

EPSS Evaluated

2026-07-05

NVD

CVE-2025-61730

Affected Vendors & Products

Vendor	Product	Version / Range
golang	go	From 1.25.0 (inc) to 1.25.2 (inc)
golang	go	From 1.25.0 (inc) to 1.25.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-NVD-CWE-noinfo

Attack-Flow Graph

Executive Summary

This vulnerability occurs during the TLS 1.3 handshake when multiple messages are sent in records that cross encryption level boundaries, such as between the Client Hello and Encrypted Extensions messages. Due to this, subsequent messages may be processed before the encryption level properly changes, potentially allowing a network-local attacker to inject messages during the handshake and cause minor information disclosure.

Impact Analysis

The vulnerability can lead to minor information disclosure if a network-local attacker is able to inject messages during the TLS 1.3 handshake. This could potentially expose some sensitive handshake information to an attacker, impacting the confidentiality of the communication.

Hi! I’m here to help you understand CVE-2025-61730. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70